diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-10-11 11:21:40 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-10-13 00:13:21 +0200 |
| commit | 58a5b32b2d5c7b6b755121930b6752e6c714f24f (patch) | |
| tree | a2e7ca10112a1fadef4592aae6d439dbb6a98226 /src | |
| parent | e98bc287019d0a5625fa0d65717846bc1802f553 (diff) | |
conntrack: ct label update requires proper ruleset
As of kernel 6.6-rc, your ruleset must use either the 'connlabel' match
in iptables or the 'ct label' statement in nftables to attach labels to
conntrack entries. Update documentation to describe this behaviour.
This patch addresses a corner case scenario: conntrack already contains
entries but ruleset that specifies connlabel did not get loaded yet.
In such case, skip ENOSPC errors for conntracks that have no ct label
extension.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1622
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/conntrack.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/conntrack.c b/src/conntrack.c index f9758d7..c1551ca 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -2195,6 +2195,11 @@ static int mnl_nfct_update_cb(const struct nlmsghdr *nlh, void *data) /* the entry has vanish in middle of the update */ if (errno == ENOENT) goto destroy_ok; + else if (cmd->options & (CT_OPT_ADD_LABEL | CT_OPT_DEL_LABEL) && + !nfct_attr_is_set(ct, ATTR_CONNLABELS) && + errno == ENOSPC) + goto destroy_ok; + exit_error(OTHER_PROBLEM, "Operation failed: %s", err2str(errno, CT_UPDATE)); |